Adform Ad Tag Swaps Wallet Addresses After Delivery, No Logs

Patching is the smaller half

Pre-auth means no credential was required. CSO Update describes a crafted HTTP request against self-hosted JetBrains TeamCity producing arbitrary command execution and credential exposure. Self-hosted CI is trivially fingerprinted from the internet. Earlier TeamCity pre-auth bugs went from disclosure to mass exploitation in days. The working assumption for any server reached before the patch is that the attacker holds every secret it ever stored: VCS tokens, cloud credentials, artifact registry keys, code-signing material, and agent authentication tokens.

Rotation is the incident response. The patch only closes the entry path. Rotation alone has a gap worth naming, because a build configuration is itself a persistence mechanism. A modified build step re-harvests whatever gets rotated on the next pipeline run, and it reads as ordinary CI activity in every log available. So the rotation ships alongside an audit of roughly 30 days of build-config changes and agent registrations, looking for entries nobody can attribute to a named person.

The cloud half has no patch column

Wiz's Azure Cosmos DB finding is the cleaner version of the same lesson. A provider-side logic bug exposed customer database access keys across tenants. The fix took eight months. During that window no customer setting, no scanner, and no patch cycle changed the outcome. Rotating primary and secondary keys is the floor. The durable move is to stop holding the credential class that leaks: set disableLocalAuth, move applications to Entra ID RBAC with managed identities, and put private endpoints or IP firewalling in front of the account.

Then instrument it. Streaming DataPlaneRequests diagnostics into the SIEM with an alert on anomalous read volume turns the next provider-side key bug from a silent cross-tenant read into a failed authentication event that shows up in a queue.

Patching a pre-auth flaw on a build server closes the entry path and does nothing whatsoever about the secrets that already left.

Three exposures, one credential class

Techpresso's guidance to rotate every Hugging Face token and enforce org-wide 2FA is the same instruction aimed at the ML supply chain instead of the build chain. The a16z discussion adds a reason to keep the receipts: with developer liability a live US policy argument, signed build attestations stop being engineering hygiene and start being evidence. Neither report names a CVE, CVSS score, or fixed build for TeamCity. The JetBrains bulletin is the authority before anyone writes the change ticket.

The control you thought you had

Every mainstream control for AI meeting assistants assumes a bot-in-the-meeting architecture: tenant settings that block third-party participants, participant-list review, and training that says look for the banner. All three are inert against capture that happens locally. There is no participant to block, no banner to notice, and the meeting platform never writes an audit event. The admin console reports a clean quarter while the transcripts accumulate somewhere else.

The corroboration is what makes this a category rather than a vendor story. Granola's differentiator is documented as consent-UI evasion, and per the reporting, no one in a Google Meet would know it is being used. A separate tool, Jamie, sells on the same line: you join the meeting, the bot does not. Two independently marketed products, one shared property, and it is the property the policy depends on detecting.

Where the evidence actually lives now

The wrist app is the friction change that matters. Activation effort was the last informal control keeping shadow recording rare, and Granola's own usage data has the watch app beating the iPhone app because, per its co-founder, out of sight means out of mind. The same app handles in-person meetings, which puts the board room, the HR investigation, and the incident-response bridge inside scope as capture surfaces.

The archive is the target, not the app

Model the threat on the artifact. An employee's notetaker account is a structured, searchable corpus of internal meetings: deal terms, roadmap decisions, named individuals, secrets read aloud on calls, and raw audio suitable for voice cloning. That is richer reconnaissance and social-engineering material than the same employee's mailbox, and it sits with a vendor procurement never onboarded. An account-compromise playbook scoped to email and chat closes the case with the highest-yield data store untouched.

The second source sharpens the downstream half. Synthetic voice is now described as practically indistinguishable, and marketplaces are paying people to license their likeness at scale. Meeting audio of executives is training data. The service-desk heuristic of recognizing a familiar voice, and any voiceprint factor still in production, are deprecated controls rather than fallbacks.

Vendor reach has outrun vendor maturity

Granola was founded in 2023 and raised at a $1.5B valuation in March 2026 from Index Ventures and Kleiner Perkins, with headcount roughly quintupled to about 100 people and no security posture disclosed anywhere in the coverage. The user base skews to VCs, founders, and executives, which makes one vendor compromise an aggregation of deal flow and an attractive collection platform for an espionage-motivated actor. The diligence asks are specific: SOC 2 Type II, a DPA, subprocessor disclosure naming which model provider processes the audio and whether it trains on it, retention and deletion controls, residency, and a breach notification SLA.

Prohibition without a sanctioned alternative produces more shadow recording, not less — one governed notetaker with the banner on by default is the floor.